Examples with EncryptedKeyVersion org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.EncryptedKeyVersion used on opensource projects

Example 6 with EncryptedKeyVersion

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.EncryptedKeyVersion in project hadoop by apache.

the class TestKMS method testKeyACLs.

@Test
@SuppressWarnings("checkstyle:methodlength")
public void testKeyACLs() throws Exception {
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    final File testDir = getTestDir();
    conf = createBaseKMSConf(testDir, conf);
    conf.set("hadoop.kms.authentication.type", "kerberos");
    conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath());
    conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost");
    conf.set("hadoop.kms.authentication.kerberos.name.rules", "DEFAULT");
    for (KMSACLs.Type type : KMSACLs.Type.values()) {
        conf.set(type.getAclConfigKey(), type.toString());
    }
    conf.set(KMSACLs.Type.CREATE.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK,DECRYPT_EEK");
    conf.set(KMSACLs.Type.ROLLOVER.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK,DECRYPT_EEK");
    conf.set(KMSACLs.Type.GENERATE_EEK.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK,DECRYPT_EEK");
    conf.set(KMSACLs.Type.DECRYPT_EEK.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "test_key.MANAGEMENT", "CREATE");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "some_key.MANAGEMENT", "ROLLOVER");
    conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", "DECRYPT_EEK");
    conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "ALL", "DECRYPT_EEK");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "all_access.ALL", "GENERATE_EEK");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "all_access.DECRYPT_EEK", "ROLLOVER");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", "ROLLOVER");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", "SOMEBODY");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "ALL", "ROLLOVER");
    writeConf(testDir, conf);
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            final URI uri = createKMSUri(getKMSUrl());
            doAs("CREATE", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "test_key");
                        options.setAttributes(newAttribs);
                        KeyProvider.KeyVersion kv = kp.createKey("k0", options);
                        Assert.assertNull(kv.getMaterial());
                        KeyVersion rollVersion = kp.rollNewVersion("k0");
                        Assert.assertNull(rollVersion.getMaterial());
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            kpce.generateEncryptedKey("k0");
                            Assert.fail("User [CREATE] should not be allowed to generate_eek on k0");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("kx", options);
                            Assert.fail("User [CREATE] should not be allowed to create kx");
                        } catch (Exception e) {
                        // Ignore
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            // Test whitelist key access..
            // DECRYPT_EEK is whitelisted for MANAGEMENT operations only
            doAs("DECRYPT_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "some_key");
                        options.setAttributes(newAttribs);
                        KeyProvider.KeyVersion kv = kp.createKey("kk0", options);
                        Assert.assertNull(kv.getMaterial());
                        KeyVersion rollVersion = kp.rollNewVersion("kk0");
                        Assert.assertNull(rollVersion.getMaterial());
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            kpce.generateEncryptedKey("kk0");
                            Assert.fail("User [DECRYPT_EEK] should not be allowed to generate_eek on kk0");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        kp.createKey("kkx", options);
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("ROLLOVER", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "test_key2");
                        options.setAttributes(newAttribs);
                        KeyProvider.KeyVersion kv = kp.createKey("k1", options);
                        Assert.assertNull(kv.getMaterial());
                        KeyVersion rollVersion = kp.rollNewVersion("k1");
                        Assert.assertNull(rollVersion.getMaterial());
                        try {
                            kp.rollNewVersion("k0");
                            Assert.fail("User [ROLLOVER] should not be allowed to rollover k0");
                        } catch (Exception e) {
                        // Ignore
                        }
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            kpce.generateEncryptedKey("k1");
                            Assert.fail("User [ROLLOVER] should not be allowed to generate_eek on k1");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("kx", options);
                            Assert.fail("User [ROLLOVER] should not be allowed to create kx");
                        } catch (Exception e) {
                        // Ignore
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("GET", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "test_key");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("k2", options);
                            Assert.fail("User [GET] should not be allowed to create key..");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("kx", options);
                            Assert.fail("User [GET] should not be allowed to create kx");
                        } catch (Exception e) {
                        // Ignore
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            final EncryptedKeyVersion ekv = doAs("GENERATE_EEK", new PrivilegedExceptionAction<EncryptedKeyVersion>() {

                @Override
                public EncryptedKeyVersion run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        kp.createKey("kx", options);
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            return kpce.generateEncryptedKey("kx");
                        } catch (Exception e) {
                            Assert.fail("User [GENERATE_EEK] should be allowed to generate_eek on kx");
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("ROLLOVER", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        kpce.decryptEncryptedKey(ekv);
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            return null;
        }
    });
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", "");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", "*");
    writeConf(testDir, conf);
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            final URI uri = createKMSUri(getKMSUrl());
            doAs("GENERATE_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                    EncryptedKeyVersion ekv = kpce.generateEncryptedKey("k1");
                    kpce.reencryptEncryptedKey(ekv);
                    return null;
                }
            });
            return null;
        }
    });
}

Example 7 with EncryptedKeyVersion

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.EncryptedKeyVersion in project hadoop by apache.

the class TestKeyProviderCryptoExtension method testDefaultCryptoExtensionSelectionWithCachingKeyProvider.

@Test
public void testDefaultCryptoExtensionSelectionWithCachingKeyProvider() throws Exception {
    Configuration config = new Configuration();
    KeyProvider localKp = new UserProvider.Factory().createProvider(new URI("user:///"), config);
    localKp = new CachingKeyProvider(localKp, 30000, 30000);
    EncryptedKeyVersion localEkv = getEncryptedKeyVersion(config, localKp);
    Assert.assertEquals(ENCRYPTION_KEY_NAME + "@0", localEkv.getEncryptionKeyVersionName());
}

Example 8 with EncryptedKeyVersion

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.EncryptedKeyVersion in project ranger by apache.

the class KMS method generateEncryptedKeys.

@SuppressWarnings({ "rawtypes", "unchecked" })
@GET
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" + KMSRESTConstants.EEK_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response generateEncryptedKeys(@PathParam("name") final String name, @QueryParam(KMSRESTConstants.EEK_OP) String edekOp, @DefaultValue("1") @QueryParam(KMSRESTConstants.EEK_NUM_KEYS) final int numKeys, @Context HttpServletRequest request) throws Exception {
    try {
        if (LOG.isDebugEnabled()) {
            LOG.debug("Entering generateEncryptedKeys method.");
        }
        UserGroupInformation user = HttpUserGroupInformation.get();
        checkNotEmpty(name, "name");
        checkNotNull(edekOp, "eekOp");
        LOG.debug("Generating encrypted key with name {}, the edek Operation is {}.", name, edekOp);
        Object retJSON;
        if (edekOp.equals(KMSRESTConstants.EEK_GENERATE)) {
            LOG.debug("edek Operation is Generate.");
            assertAccess(Type.GENERATE_EEK, user, KMSOp.GENERATE_EEK, name, request.getRemoteAddr());
            final List<EncryptedKeyVersion> retEdeks = new LinkedList<EncryptedKeyVersion>();
            try {
                user.doAs(new PrivilegedExceptionAction<Void>() {

                    @Override
                    public Void run() throws Exception {
                        LOG.debug("Generated Encrypted key for {} number of keys.", numKeys);
                        for (int i = 0; i < numKeys; i++) {
                            retEdeks.add(provider.generateEncryptedKey(name));
                        }
                        return null;
                    }
                });
            } catch (Exception e) {
                LOG.error("Exception in generateEncryptedKeys:", e);
                throw new IOException(e);
            }
            kmsAudit.ok(user, KMSOp.GENERATE_EEK, name, "");
            retJSON = new ArrayList();
            for (EncryptedKeyVersion edek : retEdeks) {
                ((ArrayList) retJSON).add(KMSUtil.toJSON(edek));
            }
        } else {
            StringBuilder error;
            error = new StringBuilder("IllegalArgumentException Wrong ");
            error.append(KMSRESTConstants.EEK_OP);
            error.append(" value, it must be ");
            error.append(KMSRESTConstants.EEK_GENERATE);
            error.append(" or ");
            error.append(KMSRESTConstants.EEK_DECRYPT);
            LOG.error(error.toString());
            throw new IllegalArgumentException(error.toString());
        }
        KMSWebApp.getGenerateEEKCallsMeter().mark();
        if (LOG.isDebugEnabled()) {
            LOG.debug("Exiting generateEncryptedKeys method.");
        }
        return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON).build();
    } catch (Exception e) {
        LOG.error("Exception in generateEncryptedKeys.", e);
        throw e;
    }
}

Example 9 with EncryptedKeyVersion

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.EncryptedKeyVersion in project hadoop by apache.

the class KMSClientProvider method parseJSONEncKeyVersions.

@SuppressWarnings("rawtypes")
private static List<EncryptedKeyVersion> parseJSONEncKeyVersions(String keyName, List valueList) {
    List<EncryptedKeyVersion> ekvs = new LinkedList<EncryptedKeyVersion>();
    if (!valueList.isEmpty()) {
        for (Object values : valueList) {
            Map valueMap = (Map) values;
            ekvs.add(parseJSONEncKeyVersion(keyName, valueMap));
        }
    }
    return ekvs;
}

Example 10 with EncryptedKeyVersion

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.EncryptedKeyVersion in project hadoop by apache.

the class TestKeyProviderCryptoExtension method testEncryptDecrypt.

@Test
public void testEncryptDecrypt() throws Exception {
    // Get an EEK
    KeyProviderCryptoExtension.EncryptedKeyVersion eek = kpExt.generateEncryptedKey(encryptionKey.getName());
    final byte[] encryptedKeyIv = eek.getEncryptedKeyIv();
    final byte[] encryptedKeyMaterial = eek.getEncryptedKeyVersion().getMaterial();
    // Decrypt it manually
    Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding");
    cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(encryptionKey.getMaterial(), "AES"), new IvParameterSpec(KeyProviderCryptoExtension.EncryptedKeyVersion.deriveIV(encryptedKeyIv)));
    final byte[] manualMaterial = cipher.doFinal(encryptedKeyMaterial);
    // Test the createForDecryption factory method
    EncryptedKeyVersion eek2 = EncryptedKeyVersion.createForDecryption(eek.getEncryptionKeyName(), eek.getEncryptionKeyVersionName(), eek.getEncryptedKeyIv(), eek.getEncryptedKeyVersion().getMaterial());
    // Decrypt it with the API
    KeyVersion decryptedKey = kpExt.decryptEncryptedKey(eek2);
    final byte[] apiMaterial = decryptedKey.getMaterial();
    assertArrayEquals("Wrong key material from decryptEncryptedKey", manualMaterial, apiMaterial);
}